MONDAY,  JANUARY  16, 1978 
PART  II 


DEPARTMENT  OF 
HEALTH, 
EDUCATION, 
AND  WELFARE 

Health  Care 
Financing  Administration 


PROFESSIONAL 
STANDARDS  REVIEW 
ORGANIZATIONS 


Confidentiality  and 
Disclosure  of  Information 


2282 


RULES  AND  REGULATIONS 


[4110-35]  . 

Title  42 — Public  Health 

CHAPTER  IV— HEALTH  CARE  FINANCING  AD¬ 
MINISTRATION,  DEPARTMENT  OF  HEALTH, 

EDUCATION,  AND  WELFARE 

SUBCHAPTER  0— PROFESSIONAL  STANDARDS 
REVIEW 

PART  476— CONFIDENTIALITY  AND  DISCLO¬ 
SURE  OF  INFORMATION  BY  PROFESSIONAL 

STANDARDS  REVIEW  ORGANIZATIONS 

AGENCY:  Health  Care  Financing  Ad¬ 
ministration  (HCFA),  HEW. 

ACTION:  Final  rule. 

SUMMARY:  This  rule  sets  forth  poli¬ 
cies  for  disclosure  of  information  ac¬ 
quired  by  Professional  Standards 
Review  Organizations  (PSROs).  Sec¬ 
tion  1166(a)  of  the  Social  Security  Act 
requires  regulations  for  the  release  of 
PSRO  information  for  other  than  the 
purposes  of  the  PSRO  statute.  The 
intent  is  that  PSRO  information 
which  was  previously  published  or  is 
in  aggregate  statistical  form  be  pro¬ 
vided  to  parties  who  need  it,  without 
violating  the  privacy  rights  of  patients 
and  health  care  practitioners,  and 
without  undue  burden.  Observance  of 
the  rule  is  intended  also  to  protect 
PSROs  against  the  risk  of  penalties 
under  section  1166(b)  of  the  Act. 

EFFECTIVE  DATE:  These  regula¬ 
tions  are  effective  on  January  16,  1978. 

FOR  FURTHER  INFORMATION 
CONTACT: 

Lois  Eberhard,  301-443-2808. 

SUPPLEMENTARY  INFORMATION: 

Background 

PSROs  review  Medicare,  Medicaid 
and  Maternal  and  Child  Health  and 
Crippled  Childrens’  services.  Some  of 
the  information  acquired  by  PSROs  in 
carrying  out  the  review  functions  are 
of  a  sensitive  or  personal  nature,  re¬ 
quiring  stringent  safeguards.  Other  in¬ 
formation  is  public  in  nature  prior  to 
receipt  by  the  PSRO  or  in  the  form  of 
statistical  summaries  that  do  not  iden¬ 
tify  individuals.  PSRO  information 
can  be  useful  to  other  parties.  These 
regulations  are  necessary  to  provide 
for  the  release  of  information  without 
subjecting  PSRO  personnel  to  the  risk 
of  penalties  under  section  1166(b)  of 
the  Act. 

The  notice  of  proposed  rulemaking 
published  on  December  3,  1976  (41  FR 
53215),  codified  these  policies  under 
Subpart  Q  of  Part  101  of  Title  42,  of 
the  Code  of  Federal  Regulations. 

Regulations  effective  October  1, 
1977  established  a  new  Chapter  IV  in 
Title  42  of  the  CFR  and  transferred 
all  Health  Care  Financing  Administra¬ 
tion  regulations  to  that  new  chapter. 
Accordingly,  these  final  regulations 
are  codified  under  42  CFR  Part  476. 


Discussion  of  Comments 

Comments,  suggestions  and  objec¬ 
tions  received  in  response  to  the  De¬ 
cember  proposal  were  considered  and 
are  summarized  below  along  with  our 
responses  thereto  and  the  changes  in 
the  proposed  rule. 

1.  Proposal  is  too  narrow.  Several 
comments  objected  to  the  publication 
of  an  interim  regulation  providing 
only  for  limited  disclosure  and  advo¬ 
cated  the  immediate  development  and 
issuance  of  a  comprehensive  regula¬ 
tion.  The  majority  of  these  comments 
recommended  much  broader  disclo¬ 
sure  to  meet  the  needs  of  the  public 
for  more  information  on  health  pro¬ 
viders  and  services,  but  still  protect 
the  privacy  rights  of  patients.  How¬ 
ever,  regulations  that  permit  the  dis¬ 
closure  of  comparatively  nonsensitive 
and  public  information  can  be  pub¬ 
lished  sooner.  It  takes  time  to  resolve 
the  broader,  more  complex  issues  that 
underlie  a  comprehensive  regulation. 
Suggestions  that  are  pertinent  to 
these  issues  are  currently  being  con¬ 
sidered  in  developing  the  comprehen¬ 
sive  regulation. 

2.  Additional  disclosure  under  the  in¬ 
terim  regulation.  It  was  recommended 
that  the  proposed  rule  be  expanded  to 
include  the  disclosure  of  the  norms, 
criteria  and  standards  used  by  the 
PSRO  and  data  collected  solely  for 
PSRO  purposes,  such  as  the  number 
of  days  certified  and  Medical  Care 
Evaluation  Studies.  The  Secretary  has 
determined  that  disclosure  of  PSRO 
norms,  criteria  and  standards  is  per¬ 
missible  under  section  1166(a)(1)  of 
the  act  without  regulations.  Data  col¬ 
lected  solely  for  PSRO  purposes  is 
beyond  the  scope  of  the  interim  rule. 
However,  the  comprehensive  regula¬ 
tion  under  development  will  reflect 
this  recommendation. 

3.  Disclosure  on  PSRO’s  own  initia¬ 
tive.  The  proposed  rule  required 
PSROs  to  disclose  specified  types  of 
data  or  information  only  upon  receipt 
of  a  request.  Several  comments  sug¬ 
gested  that  PSROs  also  be  permitted 
to  disclose  the  same  data  or  informa¬ 
tion  on  their  own  initiative,  when  ap¬ 
propriate.  This  suggestion  has  been  ac¬ 
cepted  and  included  in  the  final  rule. 

4.  Burden  on  PSROs.  Several  com¬ 
ments  expressed  concern  that  the  im¬ 
plementation  of  this  interim  regula¬ 
tion  would  place  an  excessive  burden 
on  PSROs  to  provide  data  services.  It 
is  recognized  that  the  provision  of 
data  by  PSROs  will  place  a  burden  on 
some  PSROs.  Nevertheless  it  is  consid¬ 
ered  important  that  such  data,  hereto¬ 
fore  inaccessible  in  many  geographic 
areas,  be  readily  available  to  health 
agencies  and  the  public.  This  ap¬ 
proach  will  make  it  unnecessary  for 
those  agencies  to  duplicate  the  collec¬ 
tion  and  processing  efforts  of  the 
PSRO.  Moreover,  by  requiring  that  re¬ 
quests  clearly  define  the  data  or  infor¬ 


mation  desired  and  by  permitting  the 
PSRO  to  charge  a  fee  for  data  or  in¬ 
formation  not  routinely  compiled  for 
PSRO  use,  it  is  expected  that  the 
burden  will  be  eased  somewhat. 

The  interim  regulation  does  not  re¬ 
quire  a  PSRO  to  automatically  meet 
all  requests  for  data  or  information; 
rather  it  requires  the  PSRO  to  exer¬ 
cise  judgment  regarding  the  condi¬ 
tions  of  disclosure.  These  conditions 
involve  matters  such  as  the  assurance 
that  individuals  are  not  indirectly 
identified  in  the  data  or  information 
to  be  disclosed.  However,  in  recogni¬ 
tion  of  the  need  to  establish  a  proce¬ 
dure  for  review  of  a  PSRO  decision  to 
deny  a  request  for  data  or  informa¬ 
tion,  the  interim  regulation  has  been 
amended  to  provide  for  Secretarial 
review  of  such  denials. 

5.  Confidentiality  determined  by 
source  of  information.  A  number  of  re¬ 
spondents  understood  that  §  476.2 
would  permit  the  source  of  public  in¬ 
formation  to  determine  that  such  in¬ 
formation  was  confidential,  even  after 
it  had  been  published,  and  thus  pre¬ 
vent  its  disclosure  by  the  PSROs. 
Since  it  was  not  the  intent  of  the  pro¬ 
vision  to  permit  sources  to  so  control 
the  data,  the  rule  has  been  clarified. 
The  purpose  of  the  rule  is  to  require 
disclosure  of  data  or  information 
which  was  published  prior  to  receipt 
by  the  PSRO.  Examples  of  this  type 
of  data  or  information  are  newspaper 
articles  and  annual  reports  of  health 
care  institutions  which  are  ^publicly 
distributed  by  the  institutions.* 

6.  Statistics  identify  health  care  in¬ 
stitutions.  The  proposed  rule  provided 
for  the  disclosure  of  summary  statis¬ 
tics  as  long  as  neither  patients  nor 
health  care  practitioners  could  be 
identified  through  these  summaries.  A 
number  of  comments  objected  to  this 
rule,  because  it  permits  the  disclosure 
of  data  or  information  which  identify 
health  care  institutions.  It  is  the  in¬ 
tention  of  the  Department  to  make 
such  institutional  data  available  to 
meet  a  variety  of  needs  for  health 
data,  including  identification  of  prob¬ 
lem  areas,  health  planning  and  the 
funding  of  health  services.  The  disclo¬ 
sure  of  data  about  identifiable  institu¬ 
tions  is  also  consistent  with  court  deci¬ 
sions  that  have  held  that  institutions 
have  no  right  of  privacy  under  the 
Constitution,  U.S.  v.  Morton  Salt,  338 
U.S.  632,  70  S.Ct.  357  (1950)  and  with 
section  1106(d)  of  the  Act,  which  re¬ 
quires  that  various  Medicare  contrac¬ 
tor  performance  reports,  provider  eval¬ 
uation  reports  and  provider  survey  re¬ 
ports  be  available  for  public  inspec¬ 
tion. 

On  the  other  hand,  the  Secretary  is 
mindful  that  such  institutional  infor¬ 
mation  may  be  misinterpreted  in  the 
absence  of  an  appropriate  context.  Ac¬ 
cordingly,  the  proposed  regulation 
provides  institutions  with  an  opportu- 
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nity  to  comment  and  requires  PSROs 
to  forward  those  comments  to  the  re¬ 
cipient  of  the  data  or  information  in 
order  to  correct  errors  or  inaccurate 
impressions. 

7.  Use  of  computer  tape.  Several 
comments  suggested  that  PSROs  be 
permitted  to  provide  UHDDS  data  or 
information  on  computer  tape  as  well 
as  in  the  form  of  aggregate  statistics. 
The  Department  recognizes  that  the 
disclosure  of  UHDDS  computer  tapes 
with  personal  identifiers  deleted  may 
make  the  data  more  useful  to  some 
users  and  reduce  the  burden  on 
PSROs.  However,  techniques  do  not 
exist  for  determining  if  an  individual 
could  be  identified  from  the  data  on 
the  tape.  Therefore,  the  Department 
has  rejected  the  suggestion  until  such 
techniques  for  assuring  the  privacy  of 
individuals  are  available. 

8.  Disclosure  on  basis  of  need  to 
know.  It  was  suggested  that  the  rule 
be  revised  to  permit  a  PSRO  to  dis¬ 
close  information  if  the  PSRO  deter¬ 
mines  that  the  requesting  party  has 
an  appropriate  need  to  know  the  data. 
This  approach  would  be  broader  than 
the  criteria  for  disclosure  set  out 
under  section  1166  of  the  Act,  which 
permits  disclosure  of  PSRO  data  only 
if  it  is  necessary  to  carry  out  the  pur¬ 
poses  of  title  XI,  part  B  of  the  act  or  if 
such  disclosure  has  been  determined 
by  the  Secretary  to  be  appropriate  and 
is  specified  in  regulations. 

§.  Availability  to  State  Governments. 
A  number  of  States  urged  that  all 
PSRO  data  or  information  be  avail¬ 
able  to  State  Governments.  It  is  the 
position  of  the  Department  that  a 
great  deal  of  PSRO  data  is  available  to 
State  Medicaid  agencies  presently, 
even  in  the  absence  of  regulations. 
The  States  are  now  authorized  by  the 
Secretary  to  monitor  PSRO  activities 
and  may  obtain  certain  data  to  do  so. 
PSRO  data  necessary  to  make  Medic¬ 
aid  payments  must  be  disclosed  to 
State  Medicaid  agencies  under  section 
1158  of  the  act.  Also,  data  or  informa¬ 
tion  for  other  activities  necessary  for  a 
State  Medicaid  agency  to  carry  out  the 
purposes  of  title  XI,  part  B  of  the  act 
can  be  disclosed  to  States  under  sec¬ 
tion  1166(a)  without  regulations.  Fi¬ 
nally,  the  comprehensive  regulations 
under  development  are  expected  to 
provide  for  further  disclosure  of 
PSRO  data  or  information  to  State 
agencies. 

10.  Waiver  of  NOI.  Several  com- 
menters  objected  to -the  publication  of 
a  Notice  of  Proposed  Rulemaking 
without  publishing  a  Notice  of  Intent 
beforehand,  and  maintained  that  the 
regulatory  policies  of  the  Department 
(40  FR  34811)  were  not  followed. 
While  the  regulatory  policies  of  the 
Department  encourage  the  use  of  the 
NOI,  they  do  not  require  the  Publica¬ 
tion  of  an  NOI  in  every  case.  As  stated 
in  the  preamble  to  the  proposed  rule. 


the  proposed  rule  was  published  with¬ 
out  the  use  of  a  Notice  of  Intent  (NOI) 
“because  there  is  an  urgent  require¬ 
ment  for  these  regula,tions  and  over  an 
extended  period  of  time  there  has 
been  significant  interaction  between 
the  Department  and  medical  and  con¬ 
sumer  organizations  and  interested  in¬ 
dividuals  in  the  development  of  the 
approach  contained  in  the  NPRM 
which  has  satisfied  the  spirit  and 
intent  of  the  NOI.” 

11.  Publicize  existence  of  PSRO  data. 
It  was  urged  that  the  public  should  be 
informed  of  the  existence  of  the 
PSRO  data  system.  No  revision  in  the 
present  regulation  was  needed  since 
each  PSRO  is  required,  under  its  con¬ 
tract  with  the  Department,  to  publish 
a  notice  of  the  existence,  scope  and 
purposes  of  the  PSRO  data  system. 

12.  Obtain  public  information  from 
original  source.  Comment  was  received 
suggesting  that  PSROs  refer  requests 
for  public  information  to  the  source  of 
the  information,  rather  than  furnish 
it  themselves.  This  suggestion  was  re¬ 
jected  because  such  referrals  might 
often  be  time  consuming  and  onerous, 
thereby  making  it  more  difficult  for 
persons  to  obtain  a  large  variety  of 
useful  public  data. 

13.  Applicability  of  the  Privacy  Act. 
Comments  were  received  suggesting 
that  the  “Privacy  Act  of  1974”  (5 
U.S.C.  552a)  was  applicable  to  PSROs 
and  the  provisions  of  that  Act  should 
be  reflected  in  PSRO  confidentiality 
regulations.  It  is  the  Department’s 
view  that  section  (m)  of  5  U.S.C. 
552(a).  which  makes  the  Privacy  Act 
applicable  to  government  contractors 
whose  contract  provides  for  the  oper¬ 
ation  of  a  system  of  records  on  behalf 
of  a  government  agency,  does  not 
apply  to  PSRO  contractors.  PSROs 
collect  data  primarily  to  carry  out  pur¬ 
poses  specified  by  statute  as  PSRO  re¬ 
sponsibilities,  not  the  responsibility  of 
the  Secretary,  and  each  PSRO  directly 
manages  its  own  review  operations  and 
the  records  collected  for  such  pur¬ 
poses. 

14.  Time  limit  on  interim  regula¬ 
tions.  It  was  proposed  by  some  com- 
menters  that  a  limit  be  set  on  the 
length  of  time  that  the  interim  regula¬ 
tions  are  in  effect,  to  assure  that  com¬ 
prehensive  regulations  are  published 
as  quickly  as  possible.  It  is  the  inten¬ 
tion  of  the  Department  to  publish 
comprehensive  regulations  on  PSRO 
confidentiality  as  quickly  as  the  out¬ 
standing  policy  issues  are  resolved  and 
the  procedures  necessary  for  publica¬ 
tion  of  regulations  are  completed. 
However,  since  this  time  period  is  very 
difficult  to  predict,  it  was  decided  that 
the  interim  regulations  should  not 
have  a  limit  on  the  time  for  which 
they  are  effective. 

15.  Determining  whether  data  identi¬ 
fies  individuals.  Comments  asked 
what  particular  method  would  be  used 


in  determining  whether  individual  pa¬ 
tients  or  practitioners  were  “identifi¬ 
able”  from  the  PSRO  data  to  be  dis¬ 
closed.  Of  particular  concern  is  the  in¬ 
direct  identification  of  individuals 
through  a  combination  of  attributes 
such  as  sex,  age,  dates  of  admission  or 
discharge,  diagnosis  or  procedures. 
Such  “identifiable”  data  would  not  be 
required  to  be  disclosed  under  the  in¬ 
terim  regulations.  Since  statistical 
techniques  for  implicit  identification 
of  individuals  from  statistical  informa¬ 
tion  are  highly  technical  in  nature  and 
vary  with  the  type  of  data  involved,  it 
was  not  feasible  to  specify  such  meth¬ 
ods  in  the  regulations.  HEW  will  issue 
guidelines  which  will  be  provided  to 
PSROs  on  this  subject  to  suggest 
methods  whereby  statistical  data  can 
be  displayed  to  avoid  the  identification 
of  individuals. 

16.  No  regulation  until  all  PSROs 
are  in  full  operation.  One  comment 
suggested  that  the  proposed  regula¬ 
tion  be  withdrawn  until  all  PSROs  are 
fully  operational.  To  restrict  the  use 
of  data  or  information  acquired  by 
PSROs  until  such  time  as  all' PSROs 
are  fully  operational  would  conflict 
with  the  intent  of  the  Department  to 
meet  the  current  needs  of  many  users 
of  health  data. 

17.  Information  on  existence  and 
classification  of  data.  Some  comments 
asked  that  the  regulation  establish  a 
practical  procedure  to  inform  individ¬ 
uals  of  the  types  of  information  avail¬ 
able  and  the  manner  in  which  the  in¬ 
formation  is  labeled  by  the  PSRO, 
Since  the  disclosures,  except  for  previ¬ 
ously  published  information,  required 
under  the  interim  regulation  are  limit¬ 
ed  to  data  available  only  from  the 
UHDDS,  there  should  be  little  confu¬ 
sion  over  the  specific  data  available 
from  this  source,  In  addition,  the  Sec¬ 
retary  believes  it  would  be  too  great  a 
burden  on  PSROs  to  require  all 
PSROs  to  publish  regularly  a  descrip¬ 
tion  of  all  the  previously  published 
data  which  it  has  acquired.  42  CFR 
Chaapter  I'V,  Subchapter  D,  is  amend¬ 
ed  by  adding  a  new  Part  476  to  read  as 
follows: 

Sec. 

476.1  Applicability. 

476.2  Disclosure  of  public  information  ac¬ 
quired  by  PSROs. 

476.3  Disclosure  of  Uniform  Hospital  Dis¬ 
charge  Data  Set  acquired  by  a  PSRO. 

476.4  Secretarial  Review. 

Authority:  Sec.  1166,  Social  Security  Act, 
86  Stat.  1443  (42  U.S.C.  1320C-15):  section 
1102  of  the  Social  Security  Act,  49  Stat.  647, 
as  amended  (42  U.S.C.  1302). 

§  176.1  Applicability. 

The  provisions  of  this  part  are  appli¬ 
cable  to  the  disclosure  of  information 
acquired  by  a  PSRO  in  the  exercise  of 
its  duties  and  functions  under  the 
Social  Security  Act  in  accordance  with 
section  1166  of  the  Act. 
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§  476.2  Discloaure  of  public  information 
acquired  by  PSROs. 

(a)  A  PSRO  shall,  upon  receipt  of  a 
request  for  specific  information  in  its 
possession,  provide  to  the  person 
making  the  request  a  copy  of  that  in¬ 
formation  if: 

(1)  The  information  had,  prior  to 
the  request,  been  published  or  other¬ 
wise  disclosed  to  the  public  by  any  in¬ 
dividual  or  entity  other  than  the 
PSRO  or  its  employees,  members  or 
directors,  and 

(2)  The  disclosure  of  the  informa¬ 
tion  is  not  prohibited  by  Federal  or 
State  law. 

(b)  A  PSRO  may,  on  its  own  initia¬ 
tive,  provide  to  a  person  whom  it  de¬ 
termines  to  have  an  appropriate  need 
for  such  information,  a  copy  of  any  in¬ 
formation  described  in  paragraph  (a) 
of  this  section. 

(c)  Information  provided  under  this 
section  shall  be  in  the  form  in  which  it 
is  received  by  the  PSRO  or  in  the 
form  in  which  it  is  maintained  for 
PSRO  use. 

(d)  The  PSRO  may  require  the  pay¬ 
ment  of  a  fee,  for  furnishing  informa¬ 
tion  under  this  section,  not  to  exceed 
the  reasonable  cost  of  doing  so. 

§  476.3  Disclosure  of  Uniform  Hospital 
Discharge  Data  Set  (UHDDS)  acquired 
by  a  PSRO. 

(a)  A  PSRO  shall,  upon  receipt  of  a 
request  that  clearly  defines  the  specif¬ 


ic  information  desired,  provide  to  the 
person  making  the  request,  summary 
statistics  derived  from  the  Uniform 
Hospital  Discharge  Data  Set  (the 
multi-purpose,  basic  data  set  contain¬ 
ing  information  on  a  hospital  dis¬ 
charge  approved  by  the  Secretary  for 
use  in  Federal  health  programs,  in¬ 
cluding  the  PSRO  program)  which 
does  not  directly  or  indirectly  identify 
a  particular  patient  or  health  care 
practitioner. 

(b)  A  PSRO  may  provide  to  a  person 
whom  it  determines  to  have  an  appro¬ 
priate  need  for  it,  summary  statistics 
acquired  by  the  PSRO  from  the 
UHDDS  which  does  not  directly  or  in¬ 
directly  identify  a  particular  patient 
or  health  care  practitioner. 

(c)  Information  described  in  para¬ 
graphs  (a)  and  (b)  of  this  section,  if 
routinely  compiled  for  PSRO  use. 
shall  be  provided  without  charge, 

(d)  The  PSRO  may  require  the  pay¬ 
ment  of  a  fee  for  furnishing  informa¬ 
tion  under  this  section,  not  to  exceed 
the  reasonable  cost  of  doing  so. 

(e)  If  information  provided  under 
this  section  identifies  a  particular 
health  care  institution,  the  PSRO 
shall  notify  the  institution,  at  least  15 
days  before  disclosing  the  information, 
of  its  intention  to  do  so.  The  identified 
health  care  institution  may  submit  to 
the  PSRO  comments  concerning  the 
information  to  be  disclosed,  which 
shall  be  attached  by  the  PSRO  to  such 


information  if  received  prior  to  its  dis¬ 
closure  or  forwarded  separately  by  the 
PSRO  to  the  recipient,  if  the  com¬ 
ments  are  received  after  the  informa¬ 
tion  was  disclosed. 

(f)  The  PSRO  may  attach  a  state¬ 
ment  of  comment  to  any  disclosure 
made  under  this  section. 

§  476,4  Secretarial  review. 

Any  person  whose  request  for  infor¬ 
mation  is  denied  by  the  PSRO  may  re¬ 
quest  that  the  Secretary  review  the 
decision  of  the  PSRO.  If  the  Secretary 
determines  that  the  PSRO  has  im¬ 
properly  denied  the  request,  he  shall 
direct  the  PSRO  to  provide  the  re¬ 
quested  information  and  it  shall  do  so. 

Note.— The  Health  Care  Financing  Ad- 
ministrtion  has  determined  that  this  docu¬ 
ment  does  not  contain  a  major  proposal  re¬ 
quiring  preparation  of  an  Economic  Impact 
Statement  under  Executive  Order  11821  as 
amended  by  Executive  Order  11949,  and 
OMB  Circular  A- 107. 

Dated:  November  4,  1977. 

Robert  A.  Derzon, 
Administrator,  Health  Care 
Financing  Administration. 

Approved:  January  3,  1978. 

Joseph  A.  Califano,  Jr., 

Secretary. 
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